23017cf18a4b707769ced016570ab097c5561f742ad9511a3d2f4871ebced3d6

General

Target

64d9597adb9df9f9639d679625ce44f0_JaffaCakes118
Size

1.3MB
Sample

240521-1gpxesbc5z
MD5

64d9597adb9df9f9639d679625ce44f0
SHA1

0995b131d1caa8c08ed543dba50248cffa019ff2
SHA256

23017cf18a4b707769ced016570ab097c5561f742ad9511a3d2f4871ebced3d6
SHA512

0c42c5a2fd4ed2dd1522a116ac71f227c72df0fadfbad65e46078e996908fa9dfc909eefa7ab4e29adff430c10d94c23e14fe2907d7b934e612c083682e8d7d0
SSDEEP

24576:OoL0otaYtXMheC8X3lUKfcfIkuovSp0ojro+H8j/qZq/13tdHbZKm51Ob83L:dQ7YtbX1wvTvSpLjncj/qZq/1XHNKmjH

Score

8^/10

Malware Config

Targets

- Target
  
  64d9597adb9df9f9639d679625ce44f0_JaffaCakes118
- Size
  
  1.3MB
- MD5
  
  64d9597adb9df9f9639d679625ce44f0
- SHA1
  
  0995b131d1caa8c08ed543dba50248cffa019ff2
- SHA256
  
  23017cf18a4b707769ced016570ab097c5561f742ad9511a3d2f4871ebced3d6
- SHA512
  
  0c42c5a2fd4ed2dd1522a116ac71f227c72df0fadfbad65e46078e996908fa9dfc909eefa7ab4e29adff430c10d94c23e14fe2907d7b934e612c083682e8d7d0
- SSDEEP
  
  24576:OoL0otaYtXMheC8X3lUKfcfIkuovSp0ojro+H8j/qZq/13tdHbZKm51Ob83L:dQ7YtbX1wvTvSpLjncj/qZq/1XHNKmjH
Score

8^/10

banker collection discovery evasion persistence stealth trojan
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Removes its main activity from the application launcher
  stealth trojan evasion
- Checks CPU information
  Checks CPU information which indicate if the system is an emulator.
  evasion discovery
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Queries account information for other applications stored on the device
  Application may abuse the framework's APIs to collect account information stored on the device.
  collection
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Queries information about the current Wi-Fi connection
  Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
  discovery
- Registers a broadcast receiver at runtime (usually for listening for system events)
  persistence
- Checks if the internet connection is available
  discovery
- Queries the unique device ID (IMEI, MEID, IMSI)
  discovery
- Reads information about phone network operator.
  discovery
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Removes its main activity from the application launcher

Checks CPU information

Loads dropped Dex/Jar

Queries account information for other applications stored on the device

Queries information about running processes on the device

Queries information about the current Wi-Fi connection

Registers a broadcast receiver at runtime (usually for listening for system events)

Checks if the internet connection is available

Queries the unique device ID (IMEI, MEID, IMSI)

Reads information about phone network operator.

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3